Rewterz Threat Alert – Mimic Ransomware Abuses Everything APIs for Encryption Process – Active IOCs

Severity

High

Analysis Summary

Mimic Ransomware is a new type of ransomware that has been discovered to exploit the “Everything” Application Programming Interface (API) for its encryption process. 

Researchers discovered the malware in June 2022, and it appears to target mostly English and Russian-speaking people. Some of the code in Mimic resembles that of the Conti ransomware, whose sources were revealed by a Ukrainian researcher in March 2022.

Mimic is delivered as an executable that drops various binaries and a password-protected archive that contains the ransomware payload when unpacked. It also offers tools for disabling Windows Defender and legal sdel binaries.

Mimic Ransomware is a versatile strain that is able to target specific files and folders by using command-line arguments. This allows it to selectively encrypt certain types of files, making it more difficult for victims to recover their data. Additionally, Mimic Ransomware is able to make use of multiple processor threads, which speeds up the encryption process and allows it to encrypt a large number of files in a short amount of time. This makes it more effective and efficient in spreading itself and encrypting files on a targeted computer.

Mimic ransomware is capable of a wide range of things, including the following:

• Collecting system information
• Creating persistence via the RUN key
• Bypassing User Account Control (UAC)
• Disabling Windows Defender
• Disabling Windows telemetry
• Activating anti-shutdown measures
• Activating anti-kill measures
• Unmounting Virtual Drives
• Terminating processes and services
• Disabling sleep mode and shutdown of the system
• Removing indicators
• Inhibiting System Recovery

“Everything” is a popular filename search engine for Windows developed by Voidtools. It is known for its speed, efficiency, and minimal system resource usage. The utility allows users to quickly locate files and folders on their computer by searching for their names or parts of their names. It has a simple and easy-to-use interface and can be configured to perform real-time updates, meaning it will automatically update the search results as new files are added or existing files are modified. This feature makes it a useful tool for quickly locating files on a computer, but also makes it an attractive target for malware like Mimic ransomware that can leverage this feature to quickly locate and encrypt all files on the system.

Mimic ransomware is known to use the “Everything32.dll” file, which is dropped onto the compromised system during the infection stage. This file is a component of the “Everything” search engine and contains the search capabilities that the ransomware uses to query for specific file names and extensions on the compromised system. 

Everything assists Mimic in locating files that are suitable for encryption while avoiding system files that, if locked, would leave the system unbootable.

Overview of the function (utilizing Everything API)

Mimic-encrypted files have the “.QUIETPLACE” extension. A ransom letter is also dropped, alerting the user of the attacker’s demands and how the data can be restored after paying a Bitcoin ransom.

Ransom note

It is true that Mimic ransomware is a new strain and its activity is yet to be confirmed. However, the fact that it makes use of the Conti builder and the Everything API does suggest that its authors are competent software developers who have a clear understanding of how to achieve their goals. 

The use of the Everything API, a popular search tool for Windows, suggests that the attackers have a good understanding of how the tool works and how to leverage its capabilities to locate and encrypt files on a compromised system. This highlights the need for users to be vigilant and take preventative measures to protect their systems from such attacks.

Impact

• Data Exfiltration
• Credential Theft
• Information Theft
• Financial Loss

Indicators of Compromise

MD5

• c314feb7a168bf625455afef4b8be443
• 102bd157676e752d4e9311b5d17f9d5c
• 8fb35a353978f59bd81e1e605855965e
• a48ee000e248741247c24dc70fa2f936
• a478fbfa92e188363c049d13d71632ea
• 6dcf4e9400c3eadb0ce58e7558957d8a

SHA-256

• 1dea642abe3e27fd91c3db4e0293fb1f7510e14aed73e4ea36bf7299fd8e6506
• 4a6f8bf2b989fa60daa6c720b2d388651dd8e4c60d0be04aaed4de0c3c064c8f
• b68f469ed8d9deea15af325efc1a56ca8cb5c2b42f2423837a51160456ce0db5
• bb28adc32ff1b9dcfaac6b7017b4896d2807b48080f9e6720afde3f89d69676c
• bf6fa9b06115a8a4ff3982427ddc12215bd1a3d759ac84895b5fb66eaa568bff
• ed6cf30ee11b169a65c2a27c4178c5a07ff3515daa339033bf83041faa6f49c1

SHA-1

• b009f6b5296bc506e282ab6979856e1280526a97
• ff89ff94c05ffa8acc1ba0588dd59feffc8e5475
• 66a1ca952cc666eceea66726191889e55b25b0eb
• 4c814fe7c94e6fb4d1d89cdae7e6e83905c459d7
• cca32188a8aa19394fb763495230911ee399a75c
• 05630c3157ad9c552df14804054bd63e004b7482

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Maintain daily backups of all computer networks and servers.
• Enforced Access Management Policies
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Implement a multilayered strategy as it could assist organizations in protecting potential entry points into the system (endpoint, email, web, and network).